Comprehensive Nmap Cheatsheet for Security Analysts

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source network discovery and security auditing tool. It is widely used to scan networks to discover hosts and services, making it essential for both security analysts and penetration testers.

Installation

Nmap can be installed on various operating systems. Here are the commands for popular OS:

# For Debian/Ubuntu
sudo apt install nmap

# For CentOS/RHEL
sudo yum install nmap

# For MacOS (using Homebrew)
brew install nmap

Basic Syntax

The basic syntax of Nmap is:

nmap [options] [target]

Discovery

Discovery involves identifying live hosts on a network.

Ping Scan

nmap -sn 192.168.1.0/24

This command performs a ping scan on the subnet to find live hosts.

Service Discovery

nmap -sP 192.168.1.1-10

This scans a specific range of IPs to discover services running.

Scanning

Scanning identifies open ports and services running on the hosts.

Basic TCP Scan

nmap -sS 192.168.1.1

This SYN scan quickly determines which ports are open on the target.

All TCP Ports

nmap -p- 192.168.1.1

Scans all 65535 TCP ports on the target.

Exploitation

Nmap can be utilized to find exploitable services.

Script Scanning

nmap -sC -p 80 192.168.1.1

This command runs default scripts against port 80 to identify potential vulnerabilities.

Analysis

Analyzing the results of Nmap scans is crucial.

Output to XML

nmap -oX output.xml 192.168.1.1

This command outputs the scan results to an XML file for further analysis.

Evasion

Sometimes, it’s necessary to stealthily scan.

Fragmentation

nmap -f 192.168.1.1

This command fragments packets to evade some firewalls.

Reporting

Creating reports from your scans can help in documentation.

Output Formats

nmap -oN output.txt 192.168.1.1

This outputs results in normal format to a text file.

Quick Reference Table

Flag	Description
-sn	Ping scan (no port scan)
-sS	SYN scan
-p-	Scan all ports
-sC	Run default scripts
-oX	Output results in XML

Pro Tips

• Use nmap -A to enable OS detection, version detection, script scanning, and traceroute.
• Combine multiple flags for efficiency, for example: nmap -sS -sV -O 192.168.1.1.
• Use nmap -sL to list targets without scanning.

Real-World Examples

Identifying Vulnerabilities

# Scan for all hosts and their services in the subnet with vulnerabilities identified
nmap -A 192.168.1.0/24

Firewall Evasion

# Stealthy scan to find open ports while evading detection
nmap -Pn -f 192.168.1.1